[PR #22295] [CLOSED] fix(users): return 403 for blocked primary admin role downgrade #26596

New Issue

GiteaMirror · 2026-04-20T06:35:38-05:00

GiteaMirror commented

2026-04-20 06:35:38 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/22295
Author: @haosenwang1018
Created: 3/6/2026
Status: ❌ Closed

Base: main ← Head: fix/users-update-primary-admin-http-status

📝 Commits (1)

72ddd4a fix(users): preserve 403 when primary admin role change is blocked

📊 Changes

2 files changed (+15 additions, -0 deletions)

View changed files

📝 backend/open_webui/routers/users.py (+2 -0)
📝 backend/open_webui/test/apps/webui/routers/test_users.py (+13 -0)

📄 Description

Summary

preserve HTTPException raised by the primary-admin guard in /{user_id}/update
avoid converting intentional 403 responses into 500 errors
add a regression assertion in test_users.py for primary-admin role downgrade attempts

Why

The endpoint intentionally blocks changing the first admin's role away from admin, but the broad exception handler catches that HTTPException and rethrows a 500. This patch keeps the intended 403 status code.

Testing

not run in this environment: existing backend test package references missing test.util.abstract_integration_test module

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/22295 **Author:** [@haosenwang1018](https://github.com/haosenwang1018) **Created:** 3/6/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/users-update-primary-admin-http-status` --- ### 📝 Commits (1) - [`72ddd4a`](https://github.com/open-webui/open-webui/commit/72ddd4ac42fe47135309be1b5c0f853b2a4b5829) fix(users): preserve 403 when primary admin role change is blocked ### 📊 Changes **2 files changed** (+15 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/routers/users.py` (+2 -0) 📝 `backend/open_webui/test/apps/webui/routers/test_users.py` (+13 -0) </details> ### 📄 Description ## Summary - preserve HTTPException raised by the primary-admin guard in `/{user_id}/update` - avoid converting intentional 403 responses into 500 errors - add a regression assertion in `test_users.py` for primary-admin role downgrade attempts ## Why The endpoint intentionally blocks changing the first admin's role away from `admin`, but the broad exception handler catches that HTTPException and rethrows a 500. This patch keeps the intended 403 status code. ## Testing - not run in this environment: existing backend test package references missing `test.util.abstract_integration_test` module --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-20 06:35:38 -05:00

GiteaMirror closed this issue

2026-04-20 06:35:38 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#26596